Secure Key Distribution by Swapping Quantum Entanglement 



Daegene Song 
National Institute of Standards and Technology 
100 Bureau Drive, MS 8910, Gaithersburg, MD 20899 

We report two key distribution schemes achieved by swapping quantum entanglement. Using two 
Bell states, two bits of secret key can be shared between two distant parties that play symmetric 
and equal roles. We also address eavesdropping attacks against the schemes. 

PACS numbers: 03.67.-a, 03.67.Dd 
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Cryptography has been one of the most fruitful appli- 
cations coming out of quantum information theory and 
it appears to be practically implementible in the near- 
est future among quantum technology |lj . Since the first 
key distribution protocol using four quantum states was 
proposed in 1984 (called BB84) Q, a number of crypto- 
graphic methods based on quantum mechanics have been 
proposed iaiilli El HE MM At 

the heart of quantum technology, including that of cryp- 
tography, lies entanglement. Quantum entanglement is a 
subtle nonlocal correlation between the parts of a quan- 
tum system and has no classical analog. In 1991, Ekert 
showed that quantum entanglement can be useful in 
sharing private keys between the two parties. Suppose 
Alice and Bob share many maximally entangled pairs 
of qubits. They then make measurements in jointly de- 
termined random bases. After the measurements, Al- 
ice and Bob publicly announce which basis they have 
used. If they had measured in the same basis, the keys 
would be perfectly correlated. Instead of discarding the 
keys resulting from measuring in different bases, Alice 
and Bob use them to check whether or not Bell's in- 
equality is satisfied. If it is, then Eve's presence is de- 
tected. If not, Eve is absent and they keep the perfectly 
correlated keys. Entanglement swapping 0] (also see 
(T?l fill ') is a method that enables one to entangle two 
quantum systems that do not have direct interaction with 
one another. Based on entanglement swapping, quantum 
key distribution (QKD) protocols have been introduced 
Hi US IH as well as the ones without alternative mea- 
surements B H El 13 as seen in BB84 and Ekert's 
protocols. 

In this paper, we report two QKD schemes using en- 
tanglement swapping which also do not require alterna- 
tive measurements, thereby improving the rate of gen- 
erated key bits per transmitted qubit, i.e. two bits per 
two Bell states. This rate of generated key bits is an 
improvement from the protocols introduced in H Il3| . 
In order to illustrate entanglement swapping, we first 
define four Bell states as $ ± = (|00) ± ]ll>)/ v / 2 and 
* ± = (|01) ± |10))/V2. Suppose two distant parties, Al- 
ice and Bob, share $^" 2 an d ^34 where Alice has qubits 1 
and 4, and Bob possesses 2 and 3. A measurement is per- 
formed on qubits 2 and 3 with the Bell basis, $ ± and , 5 ± , 
then the total state is projected onto \rji 



with equal probability of 1/4 for each. Previous entan- 
glement between qubits 1 and 2, and 3 and 4 are now 
swapped into entanglement between qubits 2 and 3, and 
1 and 4. Although we considered entanglement swap- 
ping with the initial state 
be achieved with other Bell states 



$3 4 , similar results can 
For example, when 



Alice and Bob initially share $^" 2 an d $347 there are four 
possible measurement outcomes with equal probability. 
If Bob gets $ + when qubits 2 and 3 are measured, then 
Alice will obtain ^~ for qubits 1 and 4. We denote this 
possibility as {'J'^' "^^l- There are three other possi- 
bilities, {$14, 1-23}, {$14^3} an d {^m,^}- Table H| 
shows Bell measurement outcomes for initial states of a 
different combination of four Bell states. 

In order to illustrate QKD based on entanglement 
swapping, we assign two bits to the measurement re- 
sults as shown in table ^ This assignment of two bits 
has a stipulation that one has to know both Alice and 
Bob's results in order to know the key bits. For in- 
stance, even if Eve knows $^4 without knowing Bob's 
result, there are still four different possible keys. We 
also introduce another basis, i.e. a rotated basis, uj^ = 
(|0+) ± \l-))/V2 and x ± = (|0-) ± |l+»/V5 where 
|+) ee yi74|0) + v ^74|l) and |-) = ^/3/l\0) - y/TJZ\l). 
The first proposed QKD protocol, which we will call 
Scheme I, goes as follows (see Fig. ^1 : 

(51) Alice prepares qubits 1 and 2 either in Bell basis, 
i.e. chosen from ^>f 2 , &f 2 , or on a rotated basis, 
w r2 ° X12 ' known only to herself. 

(52) Bob also prepares qubits 3 and 4 either in Bell ba- 
sis chosen from $^,$^4, or on a rotated basis of 



v 34> 



X34 , known only to himself. 



23 - 



14- 



* 2 + 3< 



i*^, and (774) = ®^ 
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(53) Alice sends qubit 2 to Bob and Bob transmits qubit 
4 to Alice through public channels. 

(54) Alice and Bob each publicly confirm that the other 
received the qubits. 

(55) Alice and Bob also announce which basis have been 
used (i.e. either Bell basis or a rotated basis). 

(56) If the received qubit had been prepared in the ro- 
tated basis, Alice (or Bob) rotates back the re- 
ceived qubit into Bell basis by applying Ur = 
yi74|0)(0| + V374|0)(l| + y374|l)(0|-yi74|l)(l|. 
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TABLE I: Alice (on qubits 1 and 4) and Bob's (on qubits 
2 and 3) Bell measurement results for Bell states 1 and 2, 
and 3 and 4. The symbol, "Id" means there are four possible 
outcomes for Alice and Bob's Bell measurement, {$14,^23}, 
{*i~4> *2" 3 }, {*i~4, *23> and {*r 4 , *2~ 3 } with equal probability 
of 1/4. Similarly, «+-»=> {$+,^3}, {*u>*£>}> l^,^}, 
and {$+ 4 ,*i), {*m.*m>. {^4,*2 + 3 }, 

{*i4,* 23 } 5 and "both"^{$+,* 23 }, {$ 14) *J 3 }, {*i" 4 ,*23}. 
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TABLE II: Assignment of key bits for Alice and Bob's mea- 
surement results for Scheme I. In order to discover key bits, 
one has to know both Alice and Bob's measurement results. 
For Scheme II , we assign two bits to the initial Bell state 
preparation, thereby the subscripts 14 and 23 are replaced by 
12 and 34, respectively, in the table. 

(57) Alice and Bob perform Bell measurements on 1 and 
4, and 2 and 3, respectively. 

(58) Alice and Bob announce which initial Bell states (If 
the initial state were prepared on a rotated basis, 
then it would correspond to one of four Bell states 
after rotating it back, using the same local unitary 
operation Ur in (S6)) each had prepared. 

(59) Now knowing the initial Bell states prepared by 
each other and their own measurement result, they 
could determine which Bell measurement result the 
other had obtained. 

(S10) Finally, with the given Bell measurement result, 
Alice and Bob share two key bits according to table 

eh 

For example, suppose Alice initially prepared ^^" 2 ( or 
X12) while Bob prepared (or w^). After they publicly 
announce their prepared states as in (S8), from table [fl 
they could find out that there are four possible Bell mea- 
surement outcomes: {^i^,*^}, {$ia^2?}i {*u> ^23}) 
and {^ , 1 ~4, $23}- Therefore, Alice and Bob, knowing their 
own measurement results, could determine which corre- 
lated measurement result both are sharing. If Alice got 
$^4 and Bob obtained then they will share the key 
bits "01" according to table HU 

In order to describe the second QKD scheme, we will 
assign two bits to the initial state preparations. Just as 



we assigned two bits to Alice and Bob's measurement 
results, we will assign the same two bits where initial 
state for qubits 1 and 2 replacing Alice's measurement 
result and initial Bell state of qubits 3 and 4 replacing 
Bob's measurement result in table [H] As in Scheme I, 
the key bits for (x*) will be same as 

$ ± (ig±y Thc 

second protocol is very similar to the first one, and it 
proceeds the same as the first one until (S7) of Scheme I. 
Then it goes as follows: 

(S8') Alice and Bob announce the result of their mea- 
surements. 

(S9') Now each knowing the measurement results for 
both and their own prepared state, Alice and Bob 
could determine the initial state preparation by 
each other from table Hill 

(S10') This enables Alice and Bob to share two key bits 
according to table [n] 

For example, if Alice's measurement result is $J" 4 and 
Bob obtains ^^3, then from table lTm there are four possi- 
ble state preparation: {$+ , *ik}> {*12- *34>> 
and {vE' 1 2, $34}- ^ Alice initially prepared \l/+ 2 and Bob 
prepared then they will share the key bits "01" ac- 
cording to table HT1 

Although in the QKD schemes described above assert 
that Alice and Bob publicly confirm whether the other re- 
ceived the qubits and announce initial state preparation 
or measurement result, in practice, this communication 
will be through a private channel. In order to prevent 
Eve from listening and altering these classical messages, 
encrypted messages can be used. Note that two pro- 
posed QKD schemes assume equal roles played by Alice 
and Bob. 

As in BB84, Alice and Bob can detect eavesdropping 
by comparing the shared information publicly. They will 
take out a sample and compare by publicly announcing 
both the correlated measurement results and the initial 
states. Comparing measurement result and initial states 
rather than key bits gives extra safety since there are four 
different possible measurement results (or initial prepa- 
rations for Scheme II) for each key. Let us consider an 
eavesdropping scenario for Scheme I as shown in Fig. [2] 
Eve prepares $5^ while Alice and Bob, as before, prepare 
initial states. Alice sends her qubit 2, and Eve intercepts 
it and sends qubit 6 to Bob instead. Suppose Alice and 
Bob use only the Bell basis rather than using both Bell 
and the rotated basis. Eve could perform Bell measure- 
ment on qubits 5 and 4 and perform local unitary oper- 
ation, 1 for $^" 4 , a z for $54, g x for ^jj^, and cr x a z for 
'I' 54, on qubit 2 and return it to Alice. After Alice and 
Bob announce initial preparation, Eve could find out the 
key bits Alice and Bob are sharing. However, this would 
not be possible since Alice and Bob prepared their initial 
states in both Bell and the rotated bases and announced 
the choice of basis after they confirmed the other received 
the qubit. Therefore, it is important for Alice and Bob 
not to reveal which state had been prepared initially and 
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$12*34, *r a *ii, *12*34> *U*M 
$12*34, *12*34, ^2*34, *12*M 
$12*34, $12*3~4, *?2$34, 1T2*3"4 
$12*3~4, *U*S4> *£*M> *12$34 



TABLE III: Possible state preparations for given measure- 
ment results for Scheme II. When Alice and Bob obtain the 
measurement result as in the first column, there are four pos- 
sible initial Bell state preparation (If the initial state were 
prepared on a rotated basis, then it would correspond to one 
of four Bell states after rotating it back, using the same local 
unitary operation Ur in (S6)) as shown in the second col- 
umn. The symbols in the "Measurement results" column are 
the same as in Table 

perform measurements after they confirm the other re- 
ceived the qubits. 



Practical feasibility of the proposed schemes can be 
sought in experiments that use Bell operator measure- 
ments, such as teleportation ^| and entanglement swap- 
ping |20j. Successful Bell type measurements have been 
performed using two photons, which were both path- and 
polarization entangled. Although there is an improve- 
ment of the key bit generation rate compared to the pro- 
tocol introduced by Zhao et. al. in |13(, practical im- 
plementation of the proposed scheme will have difficulty 
with classical information needed to perform neccessary 
local unitary operations before performing a Bell mea- 
surement for each photon received. 

The author thanks E. Knill for pointing out an error in 
the previous version of the proposed protocol and mak- 
ing many helpful comments. The author is also grateful 
to R. Boisvert, G. Brennen, and R. Kuhn for helpful dis- 
cussions. 
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FIG. 1: QKD using entanglement swapping. The bold line 
means qubits are entangled and the dotted line implies a Bell 
measurement is performed on the qubits. (i) Alice and Bob 
each prepare arbitrary states, either in Bell or on a rotated 
bases, known only to themselves, (ii) Each sends one qubit of 
the states to the other party, (iii) After they confirm publicly 
the other person received the qubit and announce the choice 
of basis for initial preparation, Alice and Bob perform Bell 
measurements on 1 and 4, and 2 and 3, respectively, (iv) Alice 
and Bob now announce which Bell states had been prepared 
(or their measurement result for Scheme II) , and they are 
able to find out the correlated measurement results (or initial 
state preparation for Scheme 1 1). 
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FIG. 2: Eavesdropping scheme on the proposed entanglement 
swapping QKD. As in Fig. Q the bold line means the qubits 
are entangled and the dotted line implies a Bell measurement 
is performed on the qubits. (i) While Alice and Bob prepare 
arbitrary states, Eve also prepares "J^g. (ii) Eve intercepts 
qubit 2 sent by Alice and sends qubit 6 to Bob instead, (iii) 
Eve performs a Bell measurement on qubits 5 and 4. (iv) Eve 
then performs a local operation on qubit 2 and sends it back 
to Alice. 



